General

  • Target

    2db62f11ccd00d5ec690bc313bea332b24e62dbdf63c29c24884d4589a4cd928

  • Size

    524KB

  • Sample

    240920-jbq4vsvhjl

  • MD5

    19cfa42183b1b1b28398e0a97ef0d7e6

  • SHA1

    3ea375e370f7343e85416c9769b259b605cb6eef

  • SHA256

    2db62f11ccd00d5ec690bc313bea332b24e62dbdf63c29c24884d4589a4cd928

  • SHA512

    284e489b1b1a1dea4a31a6cc2b234796dba17ef22613773c02631214b295da705aec2e21004f4285d61f4abd3c90ab5b9e8db9cb6d3dcc740ab5b1a849402863

  • SSDEEP

    12288:V5V9Ujx+5gblBdeJVoMRzKoDDFzoxWsdqJ/E9QbR:fQPblHeXzKo9zzaQR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b31a

Decoy

enjamin-paaac.buzz

mail-marketing-40950.bond

pusems28-post.cyou

hindo.top

ruck-company-be.today

asinos-deutschland.net

ewancash.boats

etdopovo.casino

rcher-saaac.buzz

871166.vip

manuel.app

g3yqo.shop

-9way.xyz

qawgytfexe.bond

iefi6834.vip

ental-health-35901.bond

idat-merkez18.top

rojectleadzone.website

lirudolph.top

migloballlc.online

Targets

    • Target

      Fedex Awb Details_pdf.exe

    • Size

      544KB

    • MD5

      e081a5f2bea797aad5cd3e9e934bb8e0

    • SHA1

      af59729a38b512cac6c3fd8896bd8123fa9bbdef

    • SHA256

      e23bf1a652dd78590f79e4a350dd7869c9c5477ef9d1dcae78504ac4fa46cada

    • SHA512

      af8210c19cdbfbd949d0d92921b98ba791e027548b4eef0f02a1efab7c6b621c5c90fe764c04b90528bd855b11d307c82bd9844adec2a8a731adce5267ab0f6d

    • SSDEEP

      12288:ygRzUZzOZgFlBNeNpoMNfsoHD3DopWIzK//a9N:nk9FlTeXLsoDDRw

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks